THE ADVANTAGES OF ELLIPTIC CURVE CRYPTOGRAPHY FOR WIRELESS SECURITY KRISTIN LAUTER, MICROSOFT CORPORATION

Transcription

1 T OPICS IN WIRELESS SECURITY THE ADVANTAGES OF ELLIPTIC CURVE CRYPTOGRAPHY FOR WIRELESS SECURITY KRISTIN LAUTER, MICROSOFT CORPORATION Q 2 = R 1 Q 2 R 1 R 1 As the wireless industry explodes, it faces a growing need for security. Both for secure (authenticated, private) Web transactions and for secure (signed, encrypted) messaging, a full and efficient Public Key Infrastructure is needed. ABSTRACT This article provides an overview of elliptic curves and their use in cryptography. The focus is on the performance advantages to be obtained in the wireless environment by using elliptic curve cryptography instead of a traditional cryptosystem like RSA. Specific applications to secure messaging and identity-based encryption are discussed. INTRODUCTION Forecasters predict more than a billion wireless users by As the wireless industry explodes, it faces a growing need for security. Applications in sectors of the economy such as healthcare, financial services, and government depend on the underlying security already available in the wired computing environment. Both for secure (authenticated, private) Web transactions and for secure (signed, encrypted) messaging, a full and efficient public key infrastructure is needed. Three basic choices for public key systems are available for these applications: RSA Diffie-Hellman (DH) or Digital Signature Algorithm (DSA) modulo a prime p Elliptic Curve Diffie-Hellman (ECDH) or Elliptic Curve Digital Signature Algorithm (ECDSA) RSA is a system that was published in 1978 by Rivest, Shamir, and Adleman, based on the difficulty of factoring large integers. Whitfield Diffie and Martin Hellman proposed the public key system now called Diffie-Hellman Key Exchange in DH is key agreement and DSA is signature, and they are not directly interchangeable, although they can be combined to do authenticated key agreement. Both the key exchange and digital signature algorithm are based on the difficulty of solving the discrete logarithm problem in the multiplicative group of integers modulo a prime p. Elliptic curve groups were proposed in 1985 as a substitute for the multiplicative groups modulo p in either the DH or DSA protocols. For the same level of security per best currently known attacks, elliptic curve-based systems can be implemented with much smaller parameters, leading to significant performance advantages. Such performance improvements are particularly important in the wireless arena where computing power, memory, and battery life of devices are more constrained. In this article we will highlight the performance advantages of elliptic curve systems by comparing their performance with RSA in the context of protocols from different standards. There are various standards bodies guiding the implementation of security protocols for the industry. Some of the organizations involved in standards activities are the Internet Engineering Task Force (IETF), American Bankers Association, International Telecommunications Union, IEEE, and National Institute of Standards and Technology (NIST). The IETF has working groups drafting standards for S/MIME, IPSec, and Transparent Layer Security (TLS). Using the Cryptographic Message Syntax (CMS) format, S/MIME specifies the protocols for exchanging signed encrypted messages or and is an alternative to PGP. IPSec is needed to establish virtual private network connections, and TLS is used to establish secure browser sessions. X.509 guides the issuing of certificates on parties public keys, and their management and revocation. In the last few years, working groups in each of these areas have added specifications for using elliptic curve groups through requestfor-comment drafts. At the level of specifying the mathematical operations underlying these protocols, the X9 organization of the American Bankers Association provides the standards ANSI X9.39 for RSA and mod p signatures, ANSI X9.62 for ECDSA and ANSI X9.63 for ECDH. Even more specific to elliptic curve cryptography is the IEEE P1363 published standard for describing implementation of elliptic curve operations. NIST provides a list of curves to be used, specified in FIPS 186-2, Digital Signature Standard. The performance advantages of elliptic curves in the SSL/TLS protocol have been analyzed in depth in [1], so we will only summarize those conclusions. The focus of this article will be to /04/$ IEEE IEEE Wireless Communications February 2004

2 Symmetric ECC DH/DSA/RSA ,360 Table 1. Key sizes for equivalent security levels (in bits). examine the impact of using elliptic curve cryptography in S/MIME instead. We will provide a brief introduction to elliptic curves in cryptography (ECC). We will give some background on S/MIME and summarize the protocols. We will present our conclusions about the performance advantages to be obtained by using elliptic curves in the wireless environment. We will explain a new application of elliptic curves in identitybased encryption that may help to launch deployment of a public key infrastructure. ELLIPTIC CURVES IN CRYPTOGRAPHY HISTORY OF ECC Elliptic curves were proposed for use as the basis for discrete logarithm-based cryptosystems almost 20 years ago, independently by Victor Miller of IBM and Neal Koblitz of the University of Washington [2, 3]. At that time, elliptic curves were already being used in various cryptographic contexts, such as integer factorization and primality proving. HISTORY OF ATTACKS Since then, many of the top mathematicians in algorithmic number theory have tried their hand at attacking elliptic curve discrete logbased cryptosystems, so far to little or no avail. Successful attacks have been found only for a few very special families of curves (e.g., the Menezes-Okomoto-Vanstone attack using the Weil pairing on supersingular elliptic curves). Versions of index calculus have been tried with no success. (Index calculus yields an attack on traditional mod p discrete log based cryptosystems by creating a factor base of small elements, finding relations between them, and solving a system of linear equations.) Weil descent has been proposed for embedding elliptic curves in higher-dimensional Abelian varieties where attacks are known, but has not yielded a good attack on elliptic curves in general. Currently, the best known attacks on elliptic curve discrete log systems run in time proportional to the square root of the group size of the elliptic curve, using Pollard rho, Pollard kangaroo, or BabyStepGiantStep algorithms. See [4, Ch. 5] for an overview of all these attacks. By comparison, much more efficient attacks are known for both RSA and mod p discrete log-based cryptosystems. For RSA, the attack goes via factoring using the Number Field Sieve (see, e.g., RSA-155 factorization [5]), and for mod p systems it is the index calculus attacks mentioned above. EQUIVALENT SECURITY LEVELS Therefore, currently, for the same level of resistance against the best known attacks, the system parameters for an elliptic-curve-based system can be chosen to be much smaller than the parameters for RSA or mod p systems. For example, an elliptic curve over a 163-bit field currently gives the same level of security as a 1024-bit RSA modulus or Diffie-Hellman prime. The difference becomes even more dramatic as the desired security level increases. For example, 571-bit ECC is currently equivalent in security to 15,360-bit RSA/DH/DSA. Public key protocols are used in combination with symmetric key algorithms. The overall strength of the system is the strength of the weakest link. Recently the new federal Advanced Encryption Standard (AES) was introduced, providing greater security than its symmetric key predecessor. At key lengths of 128, 192, and 256, AES has made ECC systems even more attractive as a key agreement alternative. Table 1 is found in a number of the standards documents (e.g., [6]). This growing difference in key bit length for equivalent security levels accounts for the performance advantages to be obtained from substituting ECC for RSA/DH/DSA in public key cryptographic protocols. ROLE OF GROUPS IN KEY EXCHANGE AND SIGNATURES The Diffie-Hellman Key Exchange and Digital Signature Algorithm can be described abstractly in the mathematical language of groups. A group is a set of elements with an operation specifying how to combine two elements to get another element of the set such that the operation satisfies certain technical properties. When we refer to mod p groups where p is some large prime number, we mean the set of natural numbers less than p where the operation is multiplication taking the remainder modulo p. A secret key exchange between two parties, A and B, can be achieved publicly if a group G and a fixed group element g are agreed upon, and if each generates a random number which they keep to themselves. If A generates the random number a and broadcasts the group element g a and B generates the random number b and broadcasts the group element g b, the common secret will be g ab, where the notation g a means to compose the element g with itself a times in the group. The security of this protocol depends on the discrete log problem being hard to solve in the given group. The discrete log problem is: given g a and g, find a. ELLIPTIC CURVE GROUPS For the purpose of cryptography, an elliptic curve can be thought of as being given by an affine equation of the form y 2 = x 3 + ax + b, where a and b are elements of a finite field with p n elements, where p is a prime larger than 3. (The equation over binary and ternary fields looks slightly different.) The set of points on the curve is the collection of ordered pairs (x, y) with coordinates in the field and such that x and This growing difference in key bit length for equivalent security levels accounts for the performance advantages to be obtained from substituting ECC for RSA/DH/DSA in public key cryptographic protocols. IEEE Wireless Communications February

3 Q 1 Q 1 + Q 2 = R 1 Q 2 R 1 Figure 1. Group law on an elliptic curve. R 1 y satisfy the relation given by the equation defining the curve, plus an extra point that is said to be at infinity. The set of points on an elliptic curve with coordinates in a finite field also form a group, and the operation is as follows: to add two points on the curve Q 1 and Q 2 together, pass a straight line through them and look for the third point of intersection with the curve, R 1. Then reflect the point R 1 over the x-axis to get R 1, the sum of Q 1 and Q 2. Thus, Q 1 + Q 2 = R 1. The idea behind this group operation is that the three points Q 1, Q 2, and R 1 lie on a common straight line, and the points that form the intersection of a function with the curve are considered to add up to be zero (Fig. 1). IMPLEMENTATION REFINEMENTS FOR ELLIPTIC CURVE CRYPTOGRAPHY To implement the Diffie-Hellman Key Exchange with an elliptic curve group, many iterations of the group operation must be performed. Therefore, it is important to optimize the implementation of the group operation. Many approaches have been explored, but choices about how to optimize the elliptic curve group operation often depend on the relative costs of operations such as multiplication and division of elements in the underlying field. AFFINE VS. PROJECTIVE COORDINATES Suppose we represent points on an elliptic curve with affine coordinates as described above. Then to add two points Q 1 = (x 1, y 1 ) and Q 2 = (x 2, y 2 ), where x 1 x 2, we first compute the slope of the line passing through them as λ = (y 2 y 1 )/ (x 2 x 1 ). This requires one division in the underlying finite field. Then solving for the third point of intersection of the line with the curve, we find that R 1 = (x 3, y 3 ), where x 3 = λ 2 x 1 x 2 and y 3 = (x 1 x 3 ) λ y 1. So forming the sum requires 1 division, 1 squaring, and 1 multiplication in the underlying finite field (p 2 or 3) when adding two affine points with distinct x-coordinates, and ignoring the cost of addition or subtraction in the field. Alternative representations for an elliptic curve and the points on it are also available. Projective and weighted projective (also called Jacobian) coordinates are sometimes used, especially in cases where division in the underlying field is costly. Weighted projective coordinates work with triples of coordinates (x, y, z), corresponding to the affine coordinates (x/z 2, y/z 3 ) whenever z 0. The advantage of weighted projective coordinates is that point addition on the elliptic curve can be done in 16 field multiplications, avoiding all field divisions. INVERSION/MULTIPLICATION RATIO Field divisions in prime fields are often reported to be roughly 80 times as costly computationally as multiplications in the field [7]. Such a ratio would clearly indicate the use of weighted projective coordinates instead of affine coordinates. However, this ratio is obtained when taking advantage of special modular reduction routines that can be used when the size of the underlying prime field has a particular form, called generalized Mersenne primes [8]. For arbitrary primes, where special modular reduction is not available, field multiplication costs are higher. For division in a finite field, a trick due to Lehmer is given in [9, p. 607] to improve the gcd algorithm for finding a modular inverse. Taking advantage of Lehmer s method can significantly cut the cost of doing field divisions. Together these two considerations lead to the fact that for random primes, a ratio of 5 or 10 to 1 is reasonable. Under these circumstances, the use of affine coordinates is warranted. STANDARD TECHNIQUES FOR FAST EXPONENTIATION Many different fast exponentiation techniques are used to perform group exponentiations. For example, to perform binary exponentiation, express the exponent as a binary string; then for each bit in the expansion, either perform a squaring or a squaring and a multiplication with the base, depending on whether bit 0 or 1 occurs in the expansion. More sophisticated and efficient versions of the binary method have been developed (e.g., [10]). Other methods available involve: 1) Windowing: using some precomputed values of the base and different window sizes to break up the binary expansion of the exponent into chunks to be processed iteratively 2) NAF: nonadjacent form of the exponent so that no two adjacent bits are both nonzero 3) Compressible exponents (See [4, pp ] for methods 1 and 2, and [11] for 3.) For elliptic curves, the group operation is written as addition instead of multiplication, and in that case exponentiation is more appropriately referred to as scalar multiplication, but the same techniques apply. For elliptic curves, the square-and-multiply technique described above is referred to as double-and-add. When using affine coordinates, a field multiplication 64 IEEE Wireless Communications February 2004

4 can be saved each time a double-and-add operation is performed in a scalar multiplication [12], leading to a more efficient implementation of elliptic curve cryptographic protocols for general elliptic curves. When field inversions are more costly than 6 field multiplications, another technique given in [13] is beneficial. It allows one to trade an inversion for 6 multiplications, and leads to an efficient algorithm for tripling a point on general elliptic curves. Finding further ways to improve elliptic curve scalar multiplication is an active area of research [7, 14, 15]. S/MIME OVERVIEW HISTORY MIME stands for Multipurpose Internet Mail Extensions, a specification for formatting messages so that they can be sent over the Internet. MIME was initiated in 1992 by the IETF. S/MIME stands for Secure MIME, and provides the following security services for electronic messages [16]: authentication, message integrity and non-repudiation of origin (using digital signatures) and privacy and data security (using encryption). PROTOCOL Suppose two parties A and B wish to exchange signed encrypted messages. Assume that A and B already have their own public key/private key pairs, and have certificates on their public keys from some common trusted certificate authority (CA). If A wants to send a message to B, A can obtain the certificate on B s public key and check its validity. Then using B s public key, A encrypts a message to B (usually just a symmetric key that subsequently acts as the contentencryption key). A may include data such as a message encrypted with a symmetric key algorithm using the content encryption key. A then signs the whole message using its own private key. When B receives the data from A, B first checks the certificate on A s public key for validity. B then uses A s public key to verify A s signature on the message. B uses its own public key to decrypt the content encryption key and uses that key to decrypt the received data. (This is an informal description; compare with X.509 strong two-way authentication protocol for details [9, p. 511].) To analyze the work load on each party, note that the sender and receiver must each perform three public key operations. The sender, A, must: 1) Verify 1 signature (on B s certificate) 2) Perform 1 encryption (using B s public key) 3) Sign message The receiver, B, must: 4) Verify 1 signature (on A s certificate) 5) Verify 1 signature (on A s message) 6) Perform 1 decryption (using its own private key) Currently RSA certificates are often issued even on elliptic curve public keys. Certificates are signed only once but verified many times, and since only the CA must perform the expensive RSA signing operation using its private key, the individual parties do not incur much computational burden in performing the RSA signature Processor MHz 163-bit 192-bit 256-bit 384-bit 521-bit 1) Ultra SPARC II ) StrongARM ) Pentium II ) Pentium II Table 2. Sample elliptic curve exponentiation timings over prime fields (in milliseconds). Processor MHz 1024-RSA d 1024-RSA e 2048-RSA d 2048-RSA e 1) Ultra SPARC II ) StrongARM ) ARM7TDMI 1 12, Table 3. Sample RSA encrypt/decrypt timings (in milliseconds). verifications of the certificates. However, using an elliptic curve cryptosystem to perform steps 2, 3, 5, and 6 can significantly decrease the computational burden on the individual parties. PERFORMANCE ADVANTAGES COMPARISON OF ECC WITH RSA We will start by giving some sample timings for RSA and ECC on different platforms. In Table 2 rows 1 and 2 are taken from [1], and do not claim to be optimized, but show two different platforms and are directly comparable to RSA numbers for the same platforms. Rows 3 and 4 in Table 2 are taken from [7] and take advantage of the special form of the generalized Mersenne primes for the NIST curves given in [17] by using specialized routines for fast modular reduction for these primes [8]. Row 3 uses affine coordinates and a binary NAF for the exponent. Row 4 uses mixed Jacobianaffine coordinates and a windowed NAF for the exponent. In Table 3 RSA d is the private key operation, whereas RSA e is the public key operation. Rows 1 and 2 are from [1], as above in the elliptic curve timings. Row 3 is from [18]. COMPARISON At the 163-bit ECC/1024-bit RSA security level, an elliptic curve exponentiation for general curves over arbitrary prime fields is roughly 5 to 15 times as fast as an RSA private key operation, depending on the platform and optimizations. At the 256-bit ECC/3072-bit RSA security level the ratio has already increased to between 20 and 60, depending on optimizations. To secure a 256-bit AES key, ECC-521 can be expected to be on average 400 times faster than 15,360-bit RSA. IMPACT ON S/MIME For example, if elliptic curve cryptosystems are used in the S/MIME protocol for signing and encryption, the sender will perform an ECDSA signature and an ECDH key agreement opera- IEEE Wireless Communications February

5 The advantage of ID-Based Encryption is that no certificate is needed to bind names to public keys. This feature may help to launch a Public Key Infrastructure, since a receiver does not have to obtain a public key and a certificate before receiving encrypted communications. tion instead of an RSA signature and an RSA encryption. For the purpose of mobile communication, a StrongARM 200 MHz processor can be thought of as a typical device. Without assuming an optimized version of ECC, use row 2 of the ECC table instead of row 4. On such a device, at the current minimum 1024-bit security level, the difference in the computation time for the sender per message is roughly 47 ms instead of 200 ms. For the recipient of a message, it would mean performing an ECDSA signature verification and an ECDH operation instead of an RSA signature verification and an RSA decryption, so the difference would be about 79 ms instead of 200 ms/message. Using the optimized versions of ECC quoted in row 4, the costs for the sender and receiver per message can be cut to roughly 8 and 12 ms. At higher security levels (e.g., for keying AES-256), RSA operations will be far too costly computationally for such a small device (roughly 45 s for sender and receiver per message), whereas ECC will cost instead roughly 56 ms for the sender per message and 84 ms for the receiver per message. IDENTITY-BASED ENCRYPTION Another application of elliptic curves in cryptography has recently emerged in the form of a new system for doing Identity-Based Encryption. Identity-Based Encryption is a public key encryption scheme where any string can be a user s public key, including, for example, the user s address or name. The advantage of ID- Based Encryption is that no certificate is needed to bind names to public keys. This feature may help to launch a public key infrastructure, since a receiver does not have to obtain a public key and a certificate before receiving encrypted communications. The sender can use the receiver s ID as its public key, and does not need to obtain and verify a certificate on the recipient s public key beforehand. Once an encrypted communication has been received, a user can contact a central CA to obtain the secret key corresponding to its public key. Identity-based signatures were first proposed by Shamir in 1984 [19], and Maurer-Yacobi proposed identity-based key agreement in 1991 [20], but these schemes were not deployed due to heavy computational costs. In 2001 Boneh and Franklin proposed a scheme that can be implemented efficiently using elliptic curves and an associated pairing map [21]. The security of the new scheme depends on the assumption that a new problem, the Bilinear Diffie-Hellman (BDH) problem, is hard. BILINEAR PAIRINGS AND THE BILINEAR DIFFIE-HELLMAN ASSUMPTION Given two groups, G 1 and G 2, a bilinear map is a map that takes a pair of elements from G 1 and sends it to an element of G 2 in a way that satisfies several important properties. The most important property is that it be linear in each entry of the pair. In other words, let P and Q be elements of the group G 1 with an additive group law, and let r be a positive integer. Write the group law for G 2 multiplicatively, and let e(p,q) be the element of G 2 which is the pairing applied to P and Q. Then the pairing must have the property that e(rp,q) = e(p,q) r = e(p, rq). The mapping must be easy to compute, yet the following problem must be hard: (BDH) Given P, rp, sp, tp in G 1, find e(p, P) rst in G 2. AN IDENTITY-BASED ENCRYPTION SCHEME USING A BILINEAR PAIRING Suppose that a CA has a global secret key s, known only to the CA. Each user has a public key Q A which is an element of G 1 corresponding to the identity A. The secret key of user A is D A = sq A in G 1. Let P and sp in G 1 be global public parameters of the system, and h be a random oracle. To encrypt a message, m, to user A, generate a random number r, then send (U,V) = (rp, m h(e(q A, sp) r )). To decrypt, A obtains D A = sq A from the CA, and computes m = V h(e(d A,U)). This decryption procedure yields the correct message because of the bilinearity of the map, since e(q A,sP) r = e(d A,U). The security of the system depends on the assumption that the BDH problem is hard, since P, sp, rp, tp are known (Q A =tp for some unknown integer t), and the system would break if e(d A,U)= e(p,p) rst could be easily computed. WEIL PAIRING ON ELLIPTIC CURVES In [21], Boneh and Franklin proposed using the group of points on an elliptic curve for the group G 1, the Weil pairing on the elliptic curve as the bilinear map, and the multiplicative group of a finite field as the group G 2. An Identity-Based Encryption scheme based on elliptic curves and the Weil pairing can be efficiently implemented using the pairing algorithm given in [4, p. 43], and using optimizations found in [12]. CONCLUSIONS Over the last five years, elliptic curve cryptography has moved from being an interesting theoretical alternative to being a cutting edge technology adopted by an increasing number of companies. There are two reasons for this new development: one is that ECC is no longer new, and has withstood a generation of attacks; second, in the growing wireless industry, its advantages over RSA have made it an attractive security alternative. Wireless Internet mail industry leaders such as Qualcomm have embraced ECC, as well as other major companies in the wireless industry such as Motorola, Docomo, and RIM. Major computer companies such as IBM, Sun Microsystems, Microsoft, and Hewlett-Packard are all investing in ECC. The U.S. government is backing the use of ECC as well, with NSA creating the security requirements for wireless devices connecting to the military, and NIST providing 66 IEEE Wireless Communications February 2004

6 standardized curves for use in a range of applications of ECC. Smartcard companies such as Gemplus are also using ECC to improve their products security. Wireless devices are rapidly becoming more dependent on security features such as the ability to do secure , secure Web browsing, and virtual private networking to corporate networks, and ECC allows more efficient implementation of all of these features. REFERENCES [1] V. Gupta, S. Gupta, and S. Chang, Performance Analysis of Elliptic Curve Cryptography for SSL, ACM Wksp. Wireless Security, Mobicom 2002, Atlanta, GA, Sept. 2002, [2] V. S. Miller, Use of Elliptic Curves in Cryptography, H. C. Williams, Ed., Advances in Cryptology CRYPTO, LNCS, vol. 218, 1985, Springer-Verlag, 1986, pp [3] N. Koblitz, Elliptic Curve Cryptosystems, Mathematics of Computation, vol. 48, 1987, pp [4] I. F. Blake, G. Seroussi, and N. P. Smart, Elliptic Curves in Cryptography, London Math. Soc. Lecture Note Series, 265, Cambridge Univ. Press, [5] J. Cowie et al., World Wide Number Field Sieve Factoring Record: on to 512 Bits, Advances in Cryptology ASIACRYPT 96, Kyongju, Korea, LNCS, vol. 1163, Springer-Verlag, 1996, pp [6] Additional ECC Groups for IKE, Mar. 2001, ietf.org/proceedings/01dec/i-d/draft-ietf-ipsec-ike-eccgroups-03.txt [7] M. Brown et al., Software Implementation of the NIST Elliptic Curves over Prime Fields, D. Naccache, Ed., Topics in Cryptology CT-RSA 2001, LNCS, vol. 2020, Springer-Verlag, 2001, pp [8] J. Solinas, Generalized Mersenne Numbers, Tech. rep., 1999, /corr99-39.ps [9] A. J. Menezes, P. C. van Oorschot, and S. A. Vanstone, Handbook of Applied Cryptography, CRC Press Series on Discrete Mathematics and Its Applications, CRC Press, [10] Daniel M. Gordon, A Survey of Fast Exponentiation Methods, J. Algorithms, vol. 27, no. 1, 1998, pp [11] Y. Yacobi, Discrete-log with Compressible Exponents, Advances in Cryptology CRYPTO 90, LNCS, vol. 537, Springer-Verlag, pp [12] K. Eisentraeger et al., Fast Elliptic Curve Arithmetic and Improved Weil Pairing Evaluation, M. Joye, Ed., Topics in Cryptology CT-RSA 2003, LNCS, vol. 2612, Springer-Verlag, 2003, pp [13] M. Ciet et al., Trading Inversions for Multiplications in Elliptic Curve Cryptography, preprint, 2003, iacr.org/ [14] J. Guajardo and C. Paar, Efficient Algorithms for Elliptic Curve Cryptosystems, B. S. Kaliski Jr., Ed., Advances in Cryptology CRYPTO, 1997, LNCS, vol. 1294, Springer-Verlag, 1997, pp [15] C. H. Lim and P. J. Lee, More Flexible Exponentiation with Precomputation, Y. G. Desmedt, Ed., Advances in Cryptology CRYPTO, LNCS, vol. 839, Springer-Verlag, 1994, pp [16] S/MIME Version 3 Message Specification, June 1999, [17] FIPS Pub 186-2, Digital Signature Standard (DSS), Jan. 27, 2000, [18] Performance of RSA on ARM and Palm, digisec.se/mcrypt_performance.htm [19] A. Shamir, Identity-Based Cryptosystems and Signature Schemes, Advances in Cryptology: Proc. CRYPTO 84, LNCS, vol. 7, 1984, pp [20] U. Maurer and Y. Yacobi, Non-interactive Public Key Cryptography, Advances in Cryptography Eurocrypt 91, LNCS, vol. 547, Springer-Verlag, 1991, pp [21] D. Boneh and M. Franklin, Identity-Based Encryption from the Weil Pairing, J. Kilian, Ed., Advances in Cryptology CRYPTO, 2001, LNCS, vol. 2139, Springer-Verlag, 2001, pp ADDITIONAL READING [1] Cryptographic Message Syntax, Aug. 2002, ietf.org/rfc/rfc3369.txt [2] IEEE Std , IEEE Standard Specifications for Public-Key Cryptography, IEEE Comp. Soc., Aug. 29, [3] Use of Elliptic Curve Cryptography (ECC) Algorithms in Cryptographic Message Syntax (CMS), Apr. 2002, [4] ECC Cipher Suites for TLS, Aug. 2002, sun.com/projects/crypto/ietf_internet-draft.pdf [5] Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, Apr. 2002, rfc3279.txt [6] ECC in X.509, Working Group Draft, Aug. 1999, BIOGRAPHY KRISTIN LAUTER (klauter@microsoft.com) received her Ph.D. in mathematics from the University of Chicago in From 1996 to 1999 she was a Hildebrandt Assistant Professor of Mathematics at the University of Michigan and spent one year as a postdoctoral fellow at the Max Planck Institute for Mathematics, Bonn, Germany. Since 1999 she has been a researcher in the Cryptography and Anti-Piracy group at Microsoft Research, working on elliptic curve cryptography and related areas. She is the author of numerous articles published in mathematical journals and a co-editor of a volume on algebraic geometry. Wireless devices are rapidly becoming more dependent on security features such as the ability to do secure , secure Web browsing, and virtual private networking to corporate networks, and ECC allows more efficient implementation of all of these features. IEEE Wireless Communications February